Vulnerability in hamradio package: defer ax25 kfree after unregister_netdev
Summary
GSD-2021-1002777: hamradio: defer ax25 kfree after unregister_netdev. Affects Kernel versions < 8a1a314965a17c62084a056b4f2cb7a770854c90. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hamradio package is a component of the Linux Kernel ecosystem. It provides support for amateur radio protocols and devices. The package allows users to communicate over radio frequencies using various protocols. One of the functionalities of the hamradio package is the ax25 module, which handles AX.25 (Amateur X.25) protocol implementation. This protocol is commonly used for packet radio communication. The ax25 module is responsible for managing network devices and their associated resources.
However, a vulnerability has been identified in the hamradio package. Specifically, there is an issue with the ax25 module's handling of resource deallocation. The module does not correctly free resources after unregistering a network device, potentially leading to memory leaks and other resource-related problems.
Vulnerability Detail
The vulnerability in the hamradio package arises from the improper handling of resource deallocation in the ax25 module. When a network device is unregistered, the module fails to properly free the associated resources. This can result in memory leaks and other resource-related issues, potentially leading to system instability or denial of service.
Attackers may be able to exploit this vulnerability by repeatedly registering and unregistering network devices, causing resource exhaustion and impacting the overall performance and stability of the system. However, the actual impact and attack plausibility have not yet been proven.
This vulnerability has been assigned the ID GSD-2021-1002777 and is fixed in Linux Kernel version v4.9.295 by commit 8a1a314965a17c62084a056b4f2cb7a770854c90.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to update the hamradio package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The hamradio package is vulnerable to a resource deallocation issue in the ax25 module. This vulnerability can result in memory leaks and other resource-related problems, potentially impacting system stability. To mitigate the risk, it is recommended to update the hamradio package to Linux Kernel version v4.9.295 or a newer version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The hamradio package is a component of the Linux Kernel ecosystem that provides support for amateur radio protocols and devices.
The ax25 module is a part of the hamradio package and handles the implementation of the AX.25 (Amateur X.25) protocol, commonly used for packet radio communication.
The vulnerability can lead to memory leaks and other resource-related problems, potentially causing system instability or denial of service.
Attackers may exploit this vulnerability by repeatedly registering and unregistering network devices, causing resource exhaustion and impacting system performance.
To fix this vulnerability, update the hamradio package to Linux Kernel version v4.9.295 or a newer version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
